`is_private` returned as str in place of boolean

[tdruez]

From aboutcode-org/scancode.io#1986

Using https://github.com/facebook/react/blob/main/packages/react-devtools-fusebox/package.json

{
  "name": "react-devtools-fusebox",
  "version": "0.0.0",
  "private": "true",
  "license": "MIT",
  "files": ["dist"],
  "scripts": {
    "build:frontend:copy-types": "cp src/*.d.ts dist/",
    "build:frontend:local": "cross-env NODE_ENV=development webpack --config webpack.config.frontend.js && yarn build:frontend:copy-types",
    "build:frontend": "cross-env NODE_ENV=production webpack --config webpack.config.frontend.js && yarn build:frontend:copy-types",
    "build": "yarn build:frontend"
  },
  "devDependencies": {
    "buffer": "^6.0.3",
    "cross-env": "^7.0.3",
    "css-loader": "^6.9.1",
    "mini-css-extract-plugin": "^2.7.7",
    "process": "^0.11.10",
    "webpack": "^5.82.1",
    "webpack-cli": "^5.1.1",
    "workerize-loader": "^2.0.2"
  }
}

scancode --package /Users/operator/Downloads/package.json --json-pp -

...
 "packages": [
    {
      "type": "npm",
      "namespace": null,
      "name": "react-devtools-fusebox",
      "version": "0.0.0",
      "qualifiers": {},
      "subpath": null,
      "primary_language": "JavaScript",
      ...
      "is_private": "true",    <------------------
      "is_virtual": false,
...

Expected value is True, but in that specific case, does the "private": "true", entry in package.json translate to is_private in the ScanCode context?

[AyanSinhaMahapatra]

This package.json is not setting private properly as per https://docs.npmjs.com/cli/v11/configuring-npm/package-json#private the private value should be a boolean, and not a string.

I added a fix at #4635

Still seems best to parse and process this correctly?

I am not sure though, since this package is actually not private as the private tag is not set properly? There seems to be a npmjs package: https://www.npmjs.com/package/react-devtools-fusebox which seems different than this one? Should we also flag this upstream?

I am also not sure about the effects of this on the package.json, is this equivalent to the package being private even though it is a string in place of a boolean?